SNX ku-Linux: amalabhulali angama-32-bit kanye nesixazululi esizisetha kabusha

I-SSL Network Extender yakwa-Check Point yehluleka ku-Linux ngezindlela ezine ezibonakalayo, futhi ezintathu kuzo zifundwa ngokungalungile njengenkinga yokungena. Kuhle kube i-binary engaqali, noma iqale ingashiyi mzila, noma ixhumane futhi ukuxazululwa kwamagama kufe, noma iphothali yesiphequluli iyasebenza kuyilapho umugqa womyalo ungasebenzi. Zisebenze ngokulandelana kwalokho, ngoba ngakunye kuyisimo sokungena salokho okulandelayo.

Uphawu lokuqala: isilayishi senqaba ngaphambi kokungena

Isifaki esithathwe ku-firewall sibeka i-binary engama-32-bit ene-setuid-root ku-/usr/bin/snx. Kusatshalaliswa kwama-64-bit ayisebenzi kuze kuvulwe i-architecture ye-i386 futhi kube khona amalabhulali ehlanganayo nawo.

sudo dpkg --add-architecture i386
sudo apt update
sudo apt install libstdc++5:i386 libstdc++6:i386 libx11-6:i386 libpam0g:i386
ldd /usr/bin/snx | grep "not found"

Uhlu lwe-not found olungenalutho luyisango lakho konke okulandelayo. Isethi yamaphakethe eqondile iyashintsha phakathi kwezindatshana: umbiko owodwa owasebenzayo wawudinga i-libstdc++5:i386, i-libx11-6:i386 ne-libpam0g:i386, omunye wawudinga ne-libstdc++6:i386. Funda i-ldd esikhundleni sokukopisha uhlu lwamaphakethe kusifundo esibhalelwe okunye ukusatshalaliswa.

Uma i-snx ingatholakali nhlobo, isifaki asikaze saqedwa noma safaka kwenye indawo ngaphandle kwe-PATH yakho. Lokho kungokunye ukwehluleka, futhi kufanele kuqinisekiswe ngaphambi kokwengeza ama-architecture ohlelweni. Hlola nge-command -v snx bese ubheka kusikhombisi esibikwe isifaki. Ukwengeza amaphakethe e-i386 kumshini ongenayo i-binary akulungisi lutho.

Uphawu lwesibili: ukungena kuyaphumelela futhi akukho okumiswa umzila

Ukungena okuphumelelayo kudala i-tunsnx futhi kuhlela ithebula lemizila ngokwalo, ngakho hlola ukuthi yini ngempela ekhona ngaphambi kokushintsha enye into.

ip -br addr show tunsnx
ip route | grep tunsnx
snx -d

Sebenzisa i-snx -d ukuze uhlakaze. Ukubulala inqubo kushiya i-interface nemizila yayo, futhi umzamo olandelayo uyohluleka ngesizathu esingenasihlobo nhlobo nokufakazela. Ukungena kokuqala kubuye kuqophe isiginesha yeseva ngaphansi kwe-/etc/snx/, yingakho umphenyi ongenamqaphi ungase udinge ukusebenza okukodwa kokuxhumana ngaphambi kokuba usebenze nhlobo. Susa leso simo kuphela uma uhlose ukuvuma iseva kabusha.

Uphawu lwesithathu: amagama ayaxazululwa kuze kukhuphuke umhubhe

Lena iyona ephuka ngokuthula. I-snx ibhala amaseva e-DNS aphushiwe ngqo ku-/etc/resolv.conf. Lapho lowo mzila uyisixhumanisi esingokomfanekiso ku-/run/systemd/resolve/, ukuhlela kungalahleka kusenzakalo esilandelayo sesixazululi, futhi ngemva kokunqamuka okufakiwe okupushiwe nakho kungase kuhlale.

Kusebenza izinhlelo ezimbili, futhi ukukhetha kufanele kube ngamabomu hhayi lokho okwaphakanyiswa umphumela wokuqala wokusesha:

• Thatha ifayela: shintsha isixhumanisi esingokomfanekiso ngokuba yifayela eliqinile bese ufaka i-libnss-resolve kanye nokuhluka kwayo kwe-i386, ukuze insizakalo yamagama ibe nendawo yokuphuma lapho ifayela libhalwa kabusha ngaphansi kwayo.
• Gcina i-systemd-resolved njengomnikazi bese ubhalisa isixhumanisi somhubhe: i-resolvectl dns tunsnx 10.0.0.10, bese kuba yi-resolvectl domain tunsnx corp.example, futhi uqinisekise nge-resolvectl status.

Bhala amaseva amagama angaphambi kwe-VPN ngaphambi kokuxhuma. Uma uhlela ifayela ngesandla, ukususa okufakiwe okupushiwe ngemva kwalokho kuyingxenye yenqubo, hhayi ukuhlanza kokuzikhethela, ngoba ikhompyutha ephathekayo egcina i-DNS yenkampani ngemva kokunqamuka ngeke ikwazi ukuxazulula enye into.

Uphawu lwesine: iphothali iyasebenza kanti i-CLI ayisebenzi

Izindatshana zakamuva ze-firewall zisuse i-middleware esipheqululini zayisa ku-Java daemon yasendaweni, ngakho iphothali ikhuluma ne-ejenti yasendaweni kupothi 14186. Lelo kheli lidinga ukukhishwa kwesitifiketi sesiphequluli kanye nenqubo esebenzayo.

ps ax | grep cshell
/usr/bin/cshell/launcher

Umugqa womyalo uyindlela ehlukile: i-snx -s vpn.example.com -u user, kanti i-~/.snxrc igcina iseva, igama lomsebenzisi kanye nokuthandwa kokuqinisekisa kabusha. Iseshini yephothali esebenzayo ayisho lutho mayelana nokuthi i-CLI ifakwe ngendlela efanele yini, futhi iklayenti elingenalutho alibhekeli amakhodi okusetshenziswa kanye.

Indlela emfushane yesiqukathi ebiza kakhulu kunalokho eyonga

I-snx ihlola imojuli ye-tun, iyilayishe uma ingekho, idala i-interface yomhubhe, ibhala kabusha imizila futhi iphushe ithrafikhi ngayo. Ukukhiqiza lokho ngaphakathi kwesiqukathi kusho ukukhweza i-/dev ne-/lib/modules nokunikeza amakhono abanzi, lokho okunikeza isiqukathi ingxenye enkulu yokuphathwa kwenethiwekhi komsingathi.

Lapho ibhokisi lesihlabathi lidingeka ngempela, umshini ongokoqobo ungumngcele ohlanzekile: iklayenti lithola i-kernel elingayishintsha, futhi umsingathi ugcina ithebula lemizila lakhe. Khetha lokho ngaphambi kokuchitha intambama kumakhono ozozisola ngokuwagabha.